Updating to Venta Theme 1.7.2 (bfcache and captcha providers) ​

1.7.2 is a patch release on top of 1.7.1. There is no Magento or Hyvä version change and no build-stack migration, so most projects need a Composer bump, a rebuild and a template rebase.

Two changes need manual action, and both are silent if you miss them: a child theme that keeps its own bundle entry file has to add one import, and a data patch rewrites stored CMS page content in place. Everything else in the release is either automatic or optional.

The features the release adds are documented on their own pages, linked from what changed below. This page covers only what an existing project has to do.

Recommended reading:

• Updating to 1.7.1, if you are not on it yet
• Back/Forward Cache, which owns the admin setting, the reverse proxy change and the bundle import
• File Review, for the override reconciliation routine

Breaking change: a child theme bundle entry needs the bfcache import ​

web/tailwind/venta-bundle.js in the vendor theme gains ./js/bundle/bfcache.js after ./js/bundle/menu.js. A child theme authors its own entry file with an explicit import list, so it inherits nothing from this change. The per-component resets are in files the list already carries; only the global guard goes missing, and it is the part that re-syncs customer section data and reloads restored private pages.

Add the import in §2.

Breaking change: the CMS data patch edits stored content ​

It replaces one exact class string:

lg:pt-7 lg:pb-3 lg:px-10 px-5 pt-5 pb-4   ->   lg:pt-7 lg:pb-3 pt-5 pb-4

That wrapper was written for the checkout agreement popups and reused as CMS page content, where its horizontal padding stacks on the padding the page layout already applies. The match is on the full string, so an unrelated px-5 or lg:px-10 elsewhere in your content is left alone. CMS blocks are skipped deliberately: the same markup renders in the checkout popups, where the padding is wanted.

The theme side of the same change zeroes the horizontal padding PageBuilder row appearances add inside CMS page content, because .columns already carries the container padding. A seeded page that was later edited therefore gets wider by the padding it was doubling, which is the intended result. A page whose author hand-wrote lg:px-10 px-5 inside a row to indent content keeps that variant, since the patch only matches the full legacy string, and it will now indent against the zeroed row padding. Re-check both kinds visually.

Pre-flight check 2 finds the affected rows before you upgrade.

Prerequisites ​

• Venta Theme 1.7.1 or 1.7.1.1. 1.7.1.1 was a patch release with no upgrade steps of its own and 1.7.2 supersedes it, so you can come from either. If you are further back, work through Updating to 1.7.1 first.
• Node 20 or newer for the theme build, unchanged since 1.7.0.
• hyva-themes/magento2-hyva-checkout 1.3.13 reachable in your Hyvä Packagist tenant. The theme package pins the exact version, so the update does not resolve without it.
• Nothing else on the server side. Hyvä stays at 1.5.2 and Magento stays where it is.

Pre-flight checklist ​

Run this while the project is still on 1.7.1.

1. Check your bundle entry file ​

grep -n "bundle/" app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind/venta-bundle.js 2>/dev/null

If that prints a list of imports, the theme maintains its own entry file and the bfcache import applies. No output means there is nothing to do.

2. Find CMS content the data patch will touch ​

SELECT page_id, identifier, title FROM cms_page
WHERE content LIKE '%lg:pt-7 lg:pb-3 lg:px-10 px-5 pt-5 pb-4%';

On a store with Hyvä Commerce, the same content lives in a second table:

SELECT identifier, title FROM hyva_commerce_cms_page
WHERE draft_content LIKE '%lg:pt-7 lg:pb-3 lg:px-10 px-5 pt-5 pb-4%'
   OR published_content LIKE '%lg:pt-7 lg:pb-3 lg:px-10 px-5 pt-5 pb-4%';

Everything these print goes on the visual check list for after the deploy. Both statements name the tables unprefixed; if the install has a db/table_prefix in app/etc/env.php, add it. The patch resolves the names itself, so it handles the prefix.

3. Inventory your template overrides in the changed areas ​

git -C app/design/frontend/<Vendor>/<ProjectTheme> ls-files \
  'Magento_Theme/templates/html/header.phtml' \
  'Magento_Theme/templates/html/footer.phtml' \
  'Magento_Theme/templates/html/cart/cart-drawer.phtml' \
  'Magento_Review/templates/form.phtml' \
  'Magento_Newsletter/templates/subscribe.phtml' \
  'Magento_Swatches/templates/product/listing/**' \
  'Magento_Swatches/templates/product/swatch-item.phtml' \
  'Magento_Catalog/templates/product/view/gallery**' \
  'Magento_Customer/templates/header/customer-menu.phtml' \
  'Magento_Customer/templates/account/authentication-popup.phtml' \
  'Magento_ReCaptchaFrontendUi/**' \
  'BoxTwentyTwo_CloudflareTurnstile/**'

§4 lists what each file needs.

4. Grep for two things that fail silently ​

grep -rn "x-spread" app/design/frontend/<Vendor>/<ProjectTheme> app/code --include='*.phtml'
grep -rn "shimmer-shine-sm" app/design/frontend/<Vendor>/<ProjectTheme> app/code

x-spread does nothing on Alpine 3 and logs nothing, so every hit is a binding that never runs and has to become x-bind. Venta's own cart drawer was one of them.

.shimmer-shine-sm is deleted from the theme's shimmer.css. It was unused in the vendor theme, but a project that adopted it loses the shine with no build error and no console error. Move those hits to shimmer-shine, or copy the old rule into your own CSS.

5. Check the Terms page and the Luma checkout fallback ​

SELECT page_id, identifier, is_active FROM cms_page WHERE identifier LIKE 'terms%';

grep -rn "Hyva_LumaCheckout\|magento2-luma-checkout" composer.json app/etc/config.php app/code

Terms and Conditions is now seeded by the theme module rather than the configurator scaffold, under the identifier terms-and-conditions. An existing page with that identifier is left alone. Any other identifier means the seeded page is created alongside yours and you have two Terms pages to reconcile. For the Luma hits, see §1.

What changed ​

PayPal 1.0.3, User Type Switcher 1.0.1 and Style Guide 1.0.3 have no changes in 1.7.2.

Where a feature has its own page, that page owns the detail:

• Back/Forward Cache for the admin setting, the reverse proxy change, the verification routine and the pattern for custom Alpine components
• Cloudflare Turnstile Configuration for the Cloudflare-side widget setup, the config paths, the one-provider-per-store rule and the removal order
• Hyvä Commerce for the Commerce suite, added as a Composer suggest in this release
• CMS Responsive Images for the responsive image directive and widget
• Base Setup for what venta:demo-data seeds
• Features for everything else

1. Update Composer dependencies ​

If your deploy runs Composer on the live server rather than in a build step, enable maintenance mode before this section rather than at §3: the Luma checkout removal below disables a module on a running store.

composer update \
  magebitcom/magento2-venta-theme \
  magebitcom/magento2-venta-theme-module \
  magebitcom/magento2-venta-theme-smile-elasticsuite-module \
  magebitcom/magento2-venta-theme-back-in-stock-module \
  --with-all-dependencies
composer show hyva-themes/magento2-hyva-checkout   # must report 1.3.13

Pin the versions in your root composer.json:

{
  "require": {
    "magebitcom/magento2-venta-theme": "1.7.2",
    "magebitcom/magento2-venta-theme-module": "1.7.2",
    "magebitcom/magento2-venta-theme-smile-elasticsuite-module": "1.7.2",
    "magebitcom/magento2-venta-theme-back-in-stock-module": "1.1.2"
  }
}

--with-all-dependencies is what lets Hyvä Checkout move to 1.3.13 to satisfy the theme's pin. If your root composer.json pins hyva-themes/magento2-hyva-checkout itself, change that line to 1.3.13 before running the update, otherwise the two pins conflict and Composer refuses to resolve.

composer update magebitcom/magento2-venta-theme-user-type-switcher

hyva-themes/magento2-luma-checkout is dropped from the reference project. It provides Hyvä's fallback to the Luma checkout for routes that have no Hyvä implementation, so a project running everything through Hyvä Checkout does not need it. Keep it if any payment method or extension still routes a checkout step through Luma. Otherwise, if the pre-flight check showed no hits, drop it in the same run:

bin/magento module:disable Hyva_LumaCheckout
composer remove hyva-themes/magento2-luma-checkout

Disable before removing. Magento builds its module list from the module.xml files present in the codebase, so once Composer has taken the package out of vendor/, module:disable fails with Unknown module(s): 'Hyva_LumaCheckout'.

2. Add the bfcache import to your bundle entry ​

Skip this if your theme has no web/tailwind/venta-bundle.js of its own.

In app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind/venta-bundle.js, add one import after the menu.js line, matching the vendor entry:

import '../../../../../../../vendor/magebitcom/magento2-venta-theme/web/tailwind/js/bundle/bfcache.js';

Keep modal-legacy-compat.js and ./generated/extension-bundle.js last, in that order, as the vendor entry does.

3. Upgrade and deploy ​

Take a database dump first. The data patch rewrites content rows.

bin/magento maintenance:enable
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

Then rebuild theme assets in your child theme. The CMS row padding rules and the list-mode swatch sizing live in the CSS build, so a stale stylesheet keeps the old spacing, and build-prod also re-bundles the JS, which is what picks up the §2 import.

cd app/design/frontend/<Vendor>/<ProjectTheme>/web/tailwind
npm ci
npm run build-prod

The rebuild writes new asset files, so deploy static content a second time and only then take the store out of maintenance mode:

bin/magento setup:static-content:deploy -f -t <Vendor>/<ProjectTheme>
bin/magento cache:flush
bin/magento maintenance:disable

4. Reconcile your template overrides ​

Work through the list the pre-flight inventory produced, following the File Review routine. What each file needs:

• Magento_Theme/templates/html/cart/cart-drawer.phtml - x-spread="pageshowHandler" becomes x-bind="pageshowHandler", or the drawer stays open on a restored page.
• Magento_Theme/templates/html/header.phtml - the Magebit\VentaTheme\ViewModel\Cart\Items import, the view model lookup and the $cartItemsCount variable are gone. If your override still uses $cartItemsCount, replace it or drop it.
• Magento_Theme/templates/html/footer.phtml - the copyright wrapper gains lg:ml-auto, which keeps the bar right-aligned when no captcha disclosure renders above it.
• Magento_Review/templates/form.phtml - the validation JS call now passes RECAPTCHA_FORM_ID_PRODUCT_REVIEW instead of RECAPTCHA_FORM_ID_CUSTOMER_CREATE. An unreconciled override keeps showing a false "token element is missing" error when reCAPTCHA is disabled for reviews.
• Magento_Newsletter/templates/subscribe.phtml - the getInputHtml() call moves out of the input row and sits below it, so an invisible widget no longer leaves a gap in the row.
• Magento_Swatches/templates/product/listing/renderer.phtml and product/swatch-item.phtml - the renderer loops to $visibleCount rather than $totalOptions, the "+N" link is shown in list mode instead of hidden, and the list-mode spacing and swatch padding classes change. An unreconciled override keeps rendering every option in list mode.
• Magento_Customer/templates/header/customer-menu.phtml and account/authentication-popup.phtml - each gains a @pageshow.window handler and a closeOnPageShow() method, without which the menu or popup stays open on a restored page.
• Magento_Catalog/templates/product/view/gallery.phtml - video slides get a cover-cropped aspect ratio taken from the first image slide, and the slide reveal binds slideMediaClass and slideMediaStyle instead of slideRevealClass.
• Magento_ReCaptchaFrontendUi/templates/js/script_loader.phtml and BoxTwentyTwo_CloudflareTurnstile/templates/hyva/js/script_loader.phtml - the theme now overrides both. Each gates on the configured captcha type rather than on a saved site key, so an unreconciled override keeps loading a vendor script whose forms have all moved to the other provider.

The narrower changes land in ElasticSuite's catalog/layer/view.phtml, catalog/layer/js/init-layered-navigation-js.phtml, catalog/layer/filter/js/attribute-filter-js.phtml, Back In Stock's customer/stock/alerts.phtml, Magebit_VentaTheme::cms-image/renderer.phtml, and web/tailwind/theme/layout.css and web/tailwind/components/shimmer.css.

5. Optional: turn on the back/forward cache ​

The theme's restore handling ships enabled; the browser cache itself does not. Enabling it takes an admin setting and a reverse proxy change, and the proxy change is the one that decides whether anything happens at all: a page still served with Cache-Control: no-store is never placed in bfcache. Backing out is the proxy change too, not the admin toggle alone.

Back/Forward Cache has the setting, the VCL edit, the reason the blunt version of it is unsafe, the equivalent for other edge layers and the verification routine.

Post-upgrade verification ​

1. The bundle loads on the checkout success page. Place a test order through to the success page and confirm venta-bundle.min.js loads with no CSP integrity error in the console. On Magento 2.4.8+ a stale sri-hashes.json blocks it.

2. The bfcache guard is in the built bundle. A zero here means the import was not added.

   bash

   grep -cF 'sales-|wishlist-' \
     pub/static/frontend/<Vendor>/<ProjectTheme>/<locale>/js/venta-bundle.min.js

   That string is the private-page body-class test inside bfcache.js and the only place in the bundle it appears. Do not grep for reload-customer-section-data instead: cart-drawer.js dispatches that event twice on its own, so the count is never zero whether or not the guard made it into the build.

3. CMS pages are not double-padded. Open every page pre-flight check 2 listed. Content lines up with the page title, and any hand-written indent still reads as intended.

4. reCAPTCHA still validates. Do this even if the project has no interest in Turnstile. Pick a form with reCAPTCHA enabled, submit it with a valid token and confirm it goes through, then submit it with the token element removed in devtools and confirm it is rejected. 1.7.2 rebinds the verification request method for every store, so a store that fails closed here fails closed on every guarded form, and one that accepts the second submission is no longer verifying at all.

5. The footer Terms link resolves. Click it. A 404 means the seeded block still points at /terms-conditions; open the footer column 3 block under Content > Blocks and change the href.

6. List mode swatches respect the limits. Switch a category to list view on a product with more swatch options than the attribute limit. The configured number renders, with the "+N" link after them.

7. Layered navigation "Show more" is scoped. On a category page, open a filter with more options than the initial list and press "Show more". The extra options belong to that category, and a failed request leaves the already-rendered options in place.

8. Checkout selects a single shipping method. With one method available, reach the shipping step and confirm it is preselected and Place Order is reachable without a click on the method.

9. If bfcache is enabled: log in, add to cart, log out, press Back. The restored page shows guest state and no cart count. Then open each overlay, navigate away and press Back: everything closed, page scrolls. The full routine is on Back/Forward Cache.